Scheduled Dynamic Updates in an HA Environment

Issue

When "sync-to peer" is enabled for dynamic updates (Application and Threats or Antivirus) scheduled to occur at the same time on both nodes of an HA cluster, the downloaded image may fail to copy to the peer.

Resolution

"Sync-to-peer" is intended when the HA secondary has no path to the Internet from the management interface. In this scenario, the secondary device must have the primary device push the dynamic updates to it. (The secondary may have no active interfaces on the dataplane in the passive mode.)

If configuring "sync-to-peer" on both nodes, make sure not to schedule the update process at the same time on both HA nodes. The copying process may fail because both nodes attempt to copy to each other.  In rare cases, this failure may cause unexpected behavior such as an HA1 link flap.  For stable updates, the best practice is to stagger the time with a sufficient gap (try 30 minutes) for scheduled updates on both devices enabled with "sync-to-peer."

owner:  yogihara